flatline alert doesn't send realert even though the event falls below the threshold at given intervals

My flatline rule config:

type: flatline

use_strftime_index: true
index: systemcollectd-%Y.%m.%d

threshold: 1

timeframe:
   minutes: 10

query_key:
- "host"

filter:
- query:
   match:
    plugin: memory

alert:
- "email"

realert:
  minutes: 10

I need to get alerts if the collectd service didn’t send metrics for memory plugin in last 10 minutes. I started the collectd service and it is sending the metrics to elasticsearch, also I found the hits value in elastalert logs. Now I stopped the collectd service. So it doesn’t send any metrics to es. In the next 10 minutes, I got the first alert from the elastalert, but after that, I didn’t get any alerts for next 10 minutes event. Still, the service is down. I was waited more than half hour, but no luck.

Now I started the collectd service again, So it starts sending metrics. After few minutes I stopped the collectd service. This time also, I got only one alert for first 10 minutes event. After that even though the service was down more than half hour, I didn’t get any alerts for this flatline rule. Can you assist me to solve this problem?

[Qmando]

Unexpected by most people. Though it has been know for a long time. https://github.com/Yelp/elastalert/issues/13

[Qmando]

This should be fixed by #751